Threat database

A stored cross-site scripting (XSS) vulnerability exists in the Mediawiki MassMessage extension prior to versions 1.43.10, 1.45.5, and 1.46.1. This vulnerability is caused by improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.1.

An open redirect vulnerability (CVE-2026-103048) exists in the Mediawiki Collection extension before versions 1.46.1, 1.45.5, and 1.43.10. This flaw allows attackers to redirect users to untrusted sites, which could be used to facilitate phishing or spoofing attacks by faking the source of data. The vulnerability has a medium severity with a CVSS score of 6.1.

A stored cross-site scripting (XSS) vulnerability exists in the CentralNotice extension of The Wikimedia Foundation's Mediawiki. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. It affects multiple versions of the Mediawiki CentralNotice extension prior to versions 1.46.1, 1.45.5, and 1.43.10. The vulnerability has a medium severity rating with a CVSS score of 6.1.

Devika version 1.0 contains a critical code injection vulnerability in the Runner.run_code function located in src/agents/runner/runner.py. This vulnerability allows an attacker to execute arbitrary code remotely without any privileges or user interaction. The vulnerability is identified as CWE-94 and has a CVSS v3.1 score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.

DB-GPT version 0.8.0 contains a critical vulnerability where its sandbox API silently falls back to LocalRuntime, resulting in code execution on the host system without user interaction. This vulnerability has a CVSS score of 9.8, indicating a severe risk of remote code execution with high impact on confidentiality, integrity, and availability.

agentgpt version 1.0.0 has an incorrect access control vulnerability in the agentRouter.ts file. This flaw allows external callers to specify an object or tenant identifier and access data without proper ownership, tenant, workspace, or membership verification. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.

CVE-2026-51864 is a critical directory traversal vulnerability in DB-GPT versions 0.7.5 and 0.8.0. It exists in the python_file_upload functionality, allowing a remote attacker to write files outside the intended workspace or storage boundary. This can lead to unauthorized file creation and potential compromise of the system.

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent._acting forwards the model-produced tool call to Toolkit.call_tool_function, which invokes execute_python_code without an additional approval or isolation boundary on that path.

agent-zero versions 1.7, 1.8, 1.9, and 1.10 contain a directory traversal vulnerability in the FileBrowser class located in python/helpers/file_browser.py. This vulnerability allows the agent to access any file on the system without restriction by initializing the workspace at the host root directory.

agent-zero versions 1.7, 1.8, 1.9, and 1.10 contain a directory traversal vulnerability in the save_file_b64 method of python/helpers/file_browser.py. This method does not properly normalize or validate user-supplied file paths, allowing attackers to write files outside the intended directory.

modelscope Agentscope versions 1.0.0 through 1.0.8 contain a path traversal vulnerability in the insert_text_file function. This vulnerability allows an attacker with low privileges to access or modify files outside the intended directory, potentially leading to full system compromise. The vulnerability has a high severity rating with a CVSS score of 8.1.

DB-GPT version 0.8.0 contains a directory traversal vulnerability in the skill_upload functionality. This flaw allows a remote attacker to write files outside the intended workspace or storage boundary, potentially leading to unauthorized file manipulation. The vulnerability has a critical severity with a CVSS score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1 contain a critical code injection vulnerability in the file src/backend/bisheng/api/v1/validate.py. This vulnerability allows an attacker to execute arbitrary code remotely without any privileges or user interaction. The vulnerability has a CVSS score of 9.8, indicating a critical severity with high impact on confidentiality, integrity, and availability.

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.

bisheng versions 2.3.0, 2.4.0, and 2.4.0-beta1 contain a directory traversal vulnerability in the save_download_file function located in src/backend/bisheng/core/cache/utils.py at line 290. This vulnerability allows an attacker to access files outside the intended directory. The CVSS score is 9.1, indicating critical severity with high confidentiality and integrity impact but no availability impact.

CVE-2026-51858 is a critical vulnerability in camel-ai camel versions 0.2.91a1, 0.2.91a2, and 0.2.91a3. The issue arises from TerminalToolkit.shell_exec allowing shell command execution driven by prompts without any approval boundary, enabling remote attackers to execute arbitrary commands without user interaction or privileges.

CVE-2026-51857 is a critical vulnerability in camel-ai versions 0.2.91a1, 0.2.91a2, and 0.2.91a3. The CodeExecutionToolkit component runs Python code produced by models through SubprocessInterpreter without an approval boundary, allowing potential unauthorized code execution.